File carving

File carving is the recovery of files from raw data by recognizing their content, rather than by following file system records. A carver scans a disk image, unallocated space, file slack or a memory dump for known signatures, such as the header bytes that start a JPEG or a PDF, and extracts data up to a matching footer, a size field or a maximum length.

Carving is useful when metadata is gone: the $MFT record of a deleted file has been reused, a volume has been reformatted, or the data sits in a file like pagefile.sys that has no internal file structure. Beyond whole files, carvers can also extract smaller records, such as event log records, MFT entries or URLs, from raw space.

Its limits are important to understand:

• Carved files have no original name, path or file system timestamps.
• Fragmented files are often recovered incomplete or mixed with unrelated data, because basic carving assumes the content is contiguous.
• Signature matches can be false positives, so every result needs validation.

Common free tools include PhotoRec, Scalpel, Foremost and bulk_extractor (which extracts features such as email addresses and URLs rather than whole files). Document the tool, version and settings used, since carving results can differ between tools. See also NTFS.